JP6751059B2 - Communication system and flow control method - Google Patents

Description

The present invention relates to a communication system, and more particularly to a DPI (Deep Packet Inspection) device.

ISPs (Internet Service Providers) are considering using DPI devices to provide communication services in response to user requests. DPI devices are generally integrated and deployed inline within the ISP network.

In particular, an application-aware service (for example, zero-rating a specific application) is being considered. In this case, however, in order to identify and control the application in the DPI device, as shown in FIG. Bidirectional flows must go through the same DPI device.

ISPs make redundancy and distribute traffic by constructing multiple transmission links with adjacent ISPs. Generally, BGP (Border Gateway Protocol) is used as a routing control protocol between ISPs with multilink connection.

"Applying Network Policy Control to Asymmetric Traffic: Considerations and Solutions", An Industry Whitepaper Jawad Khalife, Amjad Hajjar and Jesus Diaz-Verdejo, "Performance of OpenDPI in Identifying Sampled Network Traffic", JOURNAL OF NETWORKS, VOL. 8, NO. 1, pp. 71-81, JANUARY 2013

In BGP, hot potato routing is adopted in order to save resources (transmission path bandwidth, processing in each device) in its own AS (Autonomous System). The hot potato routing is a routing for transferring a packet to an external AS when the packet is transferred to the router at the AS exit closest to the external AS due to the network configuration inside the AS.

According to hot potato routing, as shown in FIG. 2, there is a possibility that “asymmetric traffic” with different routes in the up/down direction occurs. That is, with hot potato routing, the upstream flow goes through the link between the router #1 of ISP#1 and the router #2 of ISP#2, while the downstream flow is the router #4 and ISP# of ISP#2. It will go through the link with router #3 of 1. Therefore, the upstream flow and the downstream flow are input to different DPI devices #1 and #2, respectively, and it becomes impossible to perform the control that identifies the application that needs to input the bidirectional flow.

On the other hand, for such asymmetric traffic, there are two methods, a Cluster method and a State Share method, in order to input a bidirectional flow to the same DPI device and realize application identification and control in the DPI device. As shown in FIG. 3, the Cluster method is to identify and control the same DPI device by transferring the downstream flow to the DPI device through which the upstream flow has passed. On the other hand, in the State Share method, as shown in FIG. 4, by sharing the flow information (5 tuple, TCP sequence number, etc.) and the applied policy information between the DPI devices through which the upstream flow and the downstream flow pass, It is to identify and control.

Regarding the specific processing flow of the Cluster method, as shown in FIG. 5, in step S11, the upstream of the flow X is transferred to the server via the DPI device #1. At this time, the DPI device #1 holds upstream flow information (5 tuple, TCP sequence number, etc.) such as the top several packets (for example, 4 to 20 packets) of the upstream of the flow X. In step S12, the downlink of the flow X is transferred to the DPI device #2 according to hot potato routing. Since the DPI device #2 does not have the upstream flow information of the flow X, the inquiry about the upstream flow information of the flow X is broadcast to all the DPI devices in step S13. In step S14, the DPI device #1 which holds the upstream flow information of the flow X notifies the inquiry source DPI device #2 of the upstream flow information of the flow X in response to the received inquiry. In step S15, when the DPI device #2 receives the upstream flow information of the flow X from the DPI device #1, it transfers the received downstream flow to the DPI device #1. In step S16, the DPI device #1 controls the bidirectional flow X by identifying the application of the flow X from the held upstream flow information and the downstream flow transferred from the DPI device #2.

On the other hand, regarding the specific processing flow of the State Share method, as shown in FIG. 6, in step S21, the upstream of the flow X is transferred to the server via the DPI device #1. At this time, the DPI device #1 holds upstream flow information (5 tuple, TCP sequence number, etc.) such as the top several packets (for example, 4 to 20 packets) of the upstream of the flow X. In step S22, the downlink of the flow X is transferred to the DPI device #2 according to hot potato routing. Since the DPI device #2 does not have the upstream flow information of the flow X, it broadcasts the inquiry about the upstream flow information of the flow X to all the DPI devices in step S23, and at the same time, a few packets at the beginning of the downstream of the flow X ( For example, it holds downlink flow information such as 4 to 20 packets). In step S24, the DPI device #1 holding the upstream flow information of the flow X notifies the DPI device #2 of the inquiry source of the upstream flow information of the flow X in response to the received inquiry. In step S25, when the DPI device #2 receives the upstream flow information of the flow X from the DPI device #1, it notifies the DPI device #1 of the retained downstream flow information. In step S26, the DPI device #1 identifies the application of the flow X from the held upstream flow information and the downstream flow information transmitted from the DPI device #2, and obtains the application identification result and the application policy information from the DPI device #. 2 is notified and the upstream of the flow X is controlled. In step S27, when the DPI device #2 receives the application identification result and the application policy information from the DPI device #1, it controls the downlink of the flow X.

As shown in FIG. 7, the Cluster method is applicable to all cases without being limited to TCP (Transmission Control Protocol) and UDP (User Datagram Protocol), while all asymmetric downlink flows are transferred between DPI devices. As a result, the amount of traffic between DPI devices increases. It should be noted that there is observed data of about 80% of the ratio of backbone traffic to asymmetric traffic within the ISP network. Further, the non-controlled flow is also transferred to the DPI device through which the upstream of the flow X has passed, so a transfer delay occurs. On the other hand, the State Share method cannot be applied to applications in which bidirectional (upstream/downstream) flows must be input to the same DPI device, and its application range is limited. It should be noted that there is observation data that the ratio of TCP to all the flows in the ISP network is about 50%, and the traffic volume is about 70%.

In view of the above problems, an object of the present invention is to provide a DPI device that realizes efficient flow control according to the flow type.

In order to solve the above problems, one aspect of the present invention is a communication system including a plurality of DPI devices, each DPI device being applied to the input flow and a flow determination unit that manages information related to the input flow. A flow identification/control unit that executes flow control based on policy information and information about the input flow, and the input flow is other than TCP and needs to be processed bidirectionally by the same DPI device. In addition, when there is policy information applied to the downlink flow, the flow identification/control unit relates to a communication system that transfers the downlink flow to the DPI device input by the corresponding uplink flow .

According to the present invention, it is possible to provide a DPI device that realizes efficient flow control according to a flow type.

FIG. 1 is a schematic diagram showing an example of use of a DPI device. FIG. 2 is a schematic diagram showing an example of generation of asymmetric traffic. FIG. 3 is a schematic diagram showing the Cluster method. FIG. 4 is a schematic diagram showing the State Share method. FIG. 5 is a schematic diagram showing a processing flow of the Cluster method. FIG. 6 is a schematic diagram showing a processing flow of the State Share method. FIG. 7 is a diagram showing advantages and disadvantages of the conventional method. FIG. 8 is a schematic diagram showing a hybrid system according to an embodiment of the present invention. FIG. 9 is a block diagram showing the configuration of a DPI device according to an embodiment of the present invention.

Embodiments of the present invention will be described below with reference to the drawings.

In the embodiments described below, a communication system having a plurality of DPI devices is disclosed. In the communication system according to the following example, when the upstream flow and the downstream flow to be controlled are input to different DPI devices, if the input flow is TCP, the State Share method is applied, and if the input flow is other than TCP, the Cluster Method is applied. That is, as shown in FIG. 8, when the input flow to the DPI device #2 is other than TCP with respect to the input flow to be controlled, the DPI device #2 changes the input flow according to the Cluster method. When the input flow to the DPI device #2 is TCP, the DPI device #2 shares the flow information and the policy information with the DPI device #1 according to the State Share method.

As a result, compared to the conventional Cluster method, in the case of an application that does not require bidirectional (upstream/downstream) flows to be put in the same DPI device or in the case of non-controlled flows, the DPI that the upstream flow passes Since it is not necessary to transfer the downstream flow to the device, the amount of traffic flowing between the DPI devices can be reduced. Further, as for the non-controlled flow, the downstream flow is not transferred to the DPI device through which the upstream flow passes, so that the non-controlled flow does not cause a transfer delay due to the route change. On the other hand, as compared with the conventional Sate Share method, the present embodiment can be applied to the case where the bidirectional (upstream/downstream) flows have to be put in the same DPI device, so that the present embodiment has a wider application area. ..

A DPI device according to an embodiment of the present invention will be described with reference to FIG. FIG. 9 is a block diagram showing the configuration of a DPI device according to an embodiment of the present invention.

As shown in FIG. 9, the communication system 10 includes a plurality of DPI devices 100 (DPI device #1, DPI device #2,...) And a PCRF (Policy and Charging Rule Function) device 200. Typically, the communication system 10 is an AS such as an ISP, and the PCRF device 200 is a policy management device that manages a policy applied to a control target flow. The DPI device 100 controls the flow of data and packets exchanged between the user and the server of the content provider according to the policy managed by the PCRF device 200.

The DPI device 100 may be typically realized by a server, and includes, for example, a drive device, an auxiliary storage device, a memory device, a processor, an interface device, and a communication device interconnected via a bus. Various computer programs including programs for realizing various functions and processes described later in the DPI apparatus 100 are provided by a recording medium such as a CD-ROM (Compact Disk-Read Only Memory), a DVD (Digital Versatile Disk), and a flash memory. May be. When the recording medium storing the program is set in the drive device, the program is installed in the auxiliary storage device from the recording medium via the drive device. However, the program does not necessarily have to be installed on a recording medium, and may be downloaded from any external device via a network or the like. The auxiliary storage device stores the installed program and also stores necessary files and data. The memory device reads and stores the program and data from the auxiliary storage device when a program activation instruction is issued. The processor executes various functions and processes of the DPI device 100, which will be described later, according to various data such as a program stored in the memory device and parameters required to execute the program. The interface device is used as a communication interface for connecting to a network or an external device. The communication device executes various communication processes for communicating with a network such as the Internet.

However, the DPI device 100 is not limited to the hardware configuration described above, and may be realized by any other suitable hardware configuration.

In the following embodiment, it is assumed that the DPI device #1 has an upstream flow and the DPI device #2 has a downstream flow. Regarding the flow input to the DPI device 100, the flow input from Import-IF is referred to as “upstream flow” and the flow input from Export-IF is referred to as “downstream flow”.

The DPI device 100 has a flow determination unit 110 and a flow identification/control unit 120.

The flow determination unit 110 manages information regarding the input flow. Specifically, for the flow input to the DPI device 100, the flow determination unit 110 holds information (5 tuples, etc.) of the first several packets of the flow in the identification flow table as flow information. Further, the flow determination unit 110 registers, together with the flow information, a flow direction (up/down) of the flow and/or a control flag indicating whether or not the flow is a control target flow in the identification flow table. The flow determination unit 110 determines whether the input flow is registered in the identification flow table, and if the flow is not registered in the identification flow table, the input flow is registered in the identification flow table to input the input flow. Manage information about completed flows.

The flow identification/control unit 120 executes flow control based on the policy information applied to the input flow and the information about the input flow. Specifically, the flow identification/control unit 120 inquires of the PCRF device 200 whether or not the flow input to the DPI device 100 is a control target flow, and if the input flow is a control target flow, The information (5 tuples, etc.) of the first several packets of the above is stored in the control flow table as flow information. Further, the flow identification/control unit 120 holds the applied policy information (for example, the rate limit of 10 M is applied, the URL filtering is applied, etc.) in the control flow table as the control content.

Next, a processing flow executed in the DPI devices #1 and #2 according to the first embodiment will be described.

Regarding the processing of the upstream flow by the DPI device #1, when the flow X is input to the DPI device #1, the flow determination unit 110 refers to the identification flow table and determines whether the flow is a new flow or an existing flow. If it is determined that the flow is a new flow, information about the flow X is registered in the identification flow table. For example, the flow determination unit 110 holds flow information indicating information (5 tuples, etc.) of the first few packets (for example, 4 to 20 packets) of the flow X, the flow direction, and the like.

When the flow X is input, the flow identification/control unit 120 inquires of the PCRF device 200 whether there is policy information applied to the flow X. The PCRF device 200 determines whether there is policy information applied to the flow X based on, for example, the flow control setting information held in advance, and if there is the applied policy information, the PCRX device 200 sends the flow X to the DPI device #1 of the transmission source. Notify the policy information applied to. The flow identification/control unit 120 receives the received policy information (for example, a rate limit of 10M is applied, URL filtering is applied, etc.) and information of several packets at the head of the flow (5tuple etc.). It is retained in the control flow table as flow information. Further, the flow identification/control unit 120 sets the control flag (for example, 1: control target, 0: non-control target) of the flow X of the identification flow table of the flow determination unit 110.

On the other hand, regarding the processing of the downstream flow by the DPI device #2, when the flow X is input to the DPI device #2, the flow determination unit 110 refers to the identification flow table and the flow is a new flow or an existing flow. If there is a new flow, it is determined whether there is a new flow, and information about flow X is registered in the identification flow table. For example, the flow determination unit 110 holds flow information indicating information (5 tuples, etc.) of the first few packets (for example, 4 to 20 packets) of the flow X, the flow direction, and the like. Further, the flow determination unit 110 refers to the identification flow table and determines whether the flow information (5 tuple or the like) regarding the upstream flow X corresponding to the downstream flow X is registered. If the upstream flow information is not in the identification flow table, the flow determination unit 110 determines whether or not the flow X needs to identify an application in the same DPI device 100 in both directions, and performs the following different processing depending on the determination result. Run the flow. Specifically, the flow determination unit 110 can determine that it is necessary to identify an application in the same DPI device 100 in which the flow X is bidirectional according to the type of the input flow X. For example, when the input flow is TCP, the flow determination unit 110 determines that the flow X does not need to be processed bidirectionally in the same DPI device 100. On the other hand, when the input flow is other than TCP, The flow determination unit 110 may determine that the flow X needs to be processed bidirectionally in the same DPI device 100.

First, a case where the bidirectional flow X is related to an application that must be input to the same DPI device 100 will be described.

The DPI device #2 broadcasts an inquiry about upstream flow information of the flow X to all DPI devices 100.

Upon receiving the broadcasted inquiry, the flow determination unit 110 of the DPI device #1 refers to the identification flow table and determines whether there is upstream flow information regarding the flow X. When the upstream flow information regarding the flow X is detected in the identification flow table, the flow determination unit 110 further confirms the control flag of the flow X in the identification flow table, and whether there is policy information applied to the flow X, That is, it is determined whether the flow X is a control target flow. When the flow X is the control target flow, the flow determination unit 110 notifies the DPI device #2 of the inquiry source of the flow information (5 tuple or the like) of the flow X. On the other hand, when the flow X is not the control target flow, the flow determining unit 110 notifies the inquiry source DPI device #2 of the null value.

When receiving the flow information of the flow X from the DPI device #1, the flow identification/control unit 120 of the DPI device #2 transfers the downlink flow X to the DPI device #1. The flow identification/control unit 120 of the DPI device #1 identifies the application from the upstream flow information of the flow X of the control flow table and the downstream flow information of the flow X transferred from the DPI device #2, and determines the bidirectional flow X. Control.

On the other hand, when receiving a Null value from the DPI device #1, the flow determination unit 110 of the DPI device #2 registers the information regarding the flow X in the identification flow table. Similarly, the flow identification/control unit 120 registers the information on the flow X in the control flow table and transfers the flow X to the original destination.

On the other hand, a case where the bidirectional flow X is related to an application that does not need to be input to the same DPI device 100 will be described.

The DPI device #2 broadcasts an inquiry about upstream flow information of the flow X to all DPI devices 100.

Upon receiving the broadcasted inquiry, the flow determination unit 110 of the DPI device #1 refers to the identification flow table and determines whether there is upstream flow information regarding the flow X. When the upstream flow information regarding the flow X is detected in the identification flow table, the flow determination unit 110 further confirms the control flag of the flow X in the identification flow table, and whether there is policy information applied to the flow X, That is, it is determined whether the flow X is a control target flow. When the flow X is the control target flow, the flow determination unit 110 notifies the DPI device #2 of the inquiry source of the flow information (5 tuple or the like) of the flow X. On the other hand, when the flow X is not the control target flow, the flow determining unit 110 notifies the inquiry source DPI device #2 of the null value.

Upon receiving the flow information of the flow X from the DPI device #1, the flow identification/control unit 120 of the DPI device #2 outputs the flow information of the first several packets (4 to 20, etc.) of the downlink packets of the flow X to the DPI device #1. Notify 1. On the other hand, when receiving a Null value from the DPI device #1, the flow determination unit 110 of the DPI device #2 discards the held information of the first few packets and registers the flow information regarding the flow X in the identification flow table. To do. Similarly, the flow identification/control unit 120 registers the information on the flow X in the control flow table and transfers the flow X to the original destination.

The flow identification/control unit 120 of the DPI device #1 identifies the application from the flow information notified from the DPI device #2 and the upstream flow information of the flow X in the control flow table, and identifies the application identification result and the applied policy information. Notify DPI device #2.

When receiving the application identification result and the applied policy information from the DPI device #1, the flow identification/control unit 120 of the DPI device #2 controls the downlink flow X according to the policy information.

If there is upstream flow information, the flow identification/control unit 120 of the DPI devices #1 and #2 executes flow control based on the control flow table.

Next, a processing flow executed in the DPI devices #1 and #2 according to the second embodiment will be described. The second embodiment can be applied to a case where when a flow is input to the DPI device 100, it is not possible to determine whether the flow is an upstream flow or a downstream flow based on only the input IF information.

Regarding the processing of the flow by the DPI device #1, when the flow X is input to the DPI device #1, the flow determination unit 110 refers to the identification flow table and determines whether the flow is a new flow or an existing flow. If it is a new flow, the information on flow X is registered in the identification flow table. For example, the flow determination unit 110 holds flow information indicating information (5 tuples, etc.) of the first few packets (for example, 4 to 20 packets) of the flow X, the flow direction, and the like. At this time, in order to determine the flow direction, the flow determination unit 110 broadcasts a flow information inquiry about the flow X to all DPI devices 100. When receiving a response from any of the DPI devices 100, the flow determination unit 110 determines that the flow X is an upstream flow, and when a response cannot be received from any of the DPI devices 100, the flow determination unit 110 Flow X is determined to be a downstream flow, and the determination result is registered as the flow direction.

When the flow X is input, the flow identification/control unit 120 inquires of the PCRF device 200 whether there is policy information applied to the flow X. The PCRF apparatus 200 determines whether there is policy information applied to the flow X based on, for example, the flow control setting information held in advance, and if there is the applied policy information, the policy information is sent to the transmission source DPI apparatus #1. To notify. The flow identification/control unit 120 receives the received policy information (for example, a rate limit of 10M is applied, URL filtering is applied, etc.) and information of several packets at the head of the flow (5tuple etc.). It is retained in the control flow table as flow information. Further, the flow identification/control unit 120 sets the control flag (for example, 1: control target, 0: non-control target) of the flow X of the identification flow table of the flow determination unit 110.

On the other hand, regarding the processing of the flow by the DPI device #2, when the flow X is input to the DPI device #2, the flow determination unit 110 refers to the identification flow table and the flow is a new flow or an existing flow. If it is a new flow, the information about the flow X is registered in the identification flow table. For example, the flow determination unit 110 holds flow information indicating information (5 tuples, etc.) of the first few packets (for example, 4 to 20 packets) of the flow X, the flow direction, and the like. At this time, in order to determine the flow direction, the flow determination unit 110 broadcasts a flow information inquiry about the flow X to all DPI devices 100. When receiving a response from any of the DPI devices 100, the flow determination unit 110 determines that the flow X is a downstream flow, and when a response cannot be received from any of the DPI devices 100, the flow determination unit 110, Flow X is determined to be an upstream flow, and the determination result is registered as the flow direction.

Further, the flow determination unit 110 refers to the identification flow table and determines whether the flow information (5 tuple or the like) regarding the upstream flow X corresponding to the downstream flow X is registered. If the upstream flow information is not in the identification flow table, the flow determination unit 110 determines whether or not the flow X needs to identify an application in the same DPI device 100 in both directions, and performs the following different processing depending on the determination result. Run the flow. Specifically, the flow determination unit 110 can determine that it is necessary to identify an application in the same DPI device 100 in which the flow X is bidirectional according to the type of the input flow X. For example, when the input flow is TCP, the flow determination unit 110 determines that the flow X does not need to be processed bidirectionally in the same DPI device 100. On the other hand, when the input flow is other than TCP, The flow determination unit 110 may determine that the flow X needs to be processed bidirectionally in the same DPI device 100.

First, a case where the bidirectional flow X is related to an application that must be input to the same DPI device 100 will be described.

The DPI device #2 broadcasts an inquiry about upstream flow information of the flow X to all DPI devices 100.

Upon receiving the broadcasted inquiry, the flow determination unit 110 of the DPI device #1 refers to the identification flow table and determines whether there is upstream flow information regarding the flow X. When the upstream flow information regarding the flow X is detected in the identification flow table, the flow determination unit 110 further confirms the control flag of the flow X in the identification flow table, and whether there is policy information applied to the flow X, That is, it is determined whether the flow X is a control target flow. When the flow X is a control target flow, the flow determination unit 110 notifies the inquiry source DPI device #2 of the flow information (5 tuple or the like) of the flow X. On the other hand, when the flow X is not the control target flow, the flow determination unit 110 notifies the inquiry source DPI device #2 of the null value.

When receiving the flow information of the flow X from the DPI device #1, the flow identification/control unit 120 of the DPI device #2 transfers the downlink flow X to the DPI device #1. The flow identification/control unit 120 of the DPI device #1 identifies the application from the upstream flow information of the flow X of the control flow table and the downstream flow information of the flow X transferred from the DPI device #2, and determines the bidirectional flow X. Control.

On the other hand, when receiving a Null value from the DPI device #1, the flow determination unit 110 of the DPI device #2 registers the information regarding the flow X in the identification flow table. Similarly, the flow identification/control unit 120 registers the information on the flow X in the control flow table and transfers the flow X to the original destination.

On the other hand, a case where the bidirectional flow X is related to an application that does not need to be input to the same DPI device 100 will be described.

The DPI device #2 broadcasts an inquiry about upstream flow information of the flow X to all DPI devices 100.

Upon receiving the broadcasted inquiry, the flow determination unit 110 of the DPI device #1 refers to the identification flow table and determines whether there is upstream flow information regarding the flow X. When the upstream flow information regarding the flow X is detected in the identification flow table, the flow determination unit 110 further confirms the control flag of the flow X in the identification flow table, and whether there is policy information applied to the flow X, That is, it is determined whether the flow X is a control target flow. When the flow X is a control target flow, the flow determination unit 110 notifies the inquiry source DPI device #2 of the flow information (5 tuple or the like) of the flow X. On the other hand, when the flow X is not the control target flow, the flow determination unit 110 notifies the inquiry source DPI device #2 of the null value.

Upon receiving the flow information of the flow X from the DPI device #1, the flow identification/control unit 120 of the DPI device #2 outputs the flow information of the first several packets (4 to 20, etc.) of the downlink packets of the flow X to the DPI device #1. Notify 1. On the other hand, when receiving a Null value from the DPI device #1, the flow determination unit 110 of the DPI device #2 discards the held information of the first few packets and registers the flow information regarding the flow X in the identification flow table. To do. Similarly, the flow identification/control unit 120 registers the information on the flow X in the control flow table and transfers the flow X to the original destination.

The flow identification/control unit 120 of the DPI device #1 identifies the application from the flow information notified from the DPI device #2 and the upstream flow information of the flow X in the control flow table, and identifies the application identification result and the applied policy information. Notify DPI device #2.

When receiving the application identification result and the applied policy information from the DPI device #1, the flow identification/control unit 120 of the DPI device #2 controls the downlink flow X according to the policy information.

If there is upstream flow information, the flow identification/control unit 120 of the DPI devices #1 and #2 executes flow control based on the control flow table.

Although the examples of the present invention have been described above in detail, the present invention is not limited to the specific embodiments described above, and various modifications are possible within the scope of the gist of the present invention described in the claims. -Can be changed.

10 communication system 100 DPI device 110 flow determination unit 120 flow identification/control unit 200 PCRF device

Claims (6)

A communication system including a plurality of DPI devices,
Each DPI device
A flow determination unit that manages information about the input flow,
A flow identification/control unit that executes flow control based on policy information applied to the input flow and information about the input flow;
Have
If the input flow is other than TCP, it needs to be processed by the same DPI device in both directions, and if there is policy information applied to the downlink flow, the flow identification/control unit, the downlink flow A communication system that transfers the data to the DPI device input by the corresponding upstream flow . If the input flow is TCP, does not need to be processed bidirectionally by the same DPI device, and if there is policy information applied to the downlink flow, the flow determination unit inputs the corresponding upstream flow. to share information on the input flow between the DPI device, the flow identification and control unit transfers the downlink flow to the destination, the communication system according to claim 1, wherein. The communication system according to claim 1 or 2 , wherein the DPI device that receives the downlink flow broadcasts an inquiry for information regarding the corresponding uplink flow to the DPI device of the communication system. The flow determination unit has an identification flow table having flow information regarding the input flow, flow direction, and control suitability information,
The communication system according to any one of claims 1 to 3 , wherein the flow identification/control unit has a control flow table having flow information and control content regarding the input flow. The flow determination unit broadcasts an inquiry about information about the input flow to a DPI device of the communication system, and determines a flow direction of the input flow according to the presence or absence of a response to the inquiry. 4. The communication system according to any one of 4 above. A flow control method executed by a communication system including a plurality of DPI devices,
Receiving an input flow,
Determining whether the input flow needs to be processed in the same DPI device in both directions,
Determining whether there is policy information applied to the input flow,
If the input flow is other than TCP, needs to be processed bidirectionally by the same DPI device, and there is policy information applied to the downlink flow, the downlink flow is input by the corresponding uplink flow. Transferring to a DPI device ,
A method having.

Images